Detect suspicious or malicious use of mshta.exe

Gurpreet Suhi@gsuhi

•updated Apr 29, 2026•25•1•530

This rule detects suspicious or malicious use of mshta.exe. It flags executions where mshta.exe is not launched from standard system directories (C:\Windows\System32 or C:\Windows\SysWOW64), or when its command line contains indicators of remote or script execution (e.g., URLs, .hta, .js, .vbs extensions, javascript:, vbscript:). Additionally, it identifies suspicious parent processes that initiate mshta.exe, such as command shells (cmd.exe, powershell.exe), script hosts (wscript.exe, cscript.exe), installers (msiexec.exe), or common Microsoft Office applications (winword.exe, excel.exe).